pusher-js

Build provenancecaution

No build attestation or trusted publisher provenance is recorded, leaving publication origin less independently verifiable than it could be.

Repo bus factorcaution

All four recent commits came from one contributor, creating a concentrated maintenance risk; organization backing provides some capacity to hand work off but does not remove the present concentration.

Repo commit activitycaution

Four commits occurred in the last three months, showing recent activity, though the volume is modest.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All four workflows were analyzed successfully and have no untrusted checkouts or script-injection findings, but all 13 action references are unpinned. The informational trusted-publishing finding is not independently severe, though it adds publication-hygiene concern.